LynkUps — Privacy Policy (Draft v0.1, en-GB — UK GDPR / GDPR)

⚠️ DRAFT for review by a qualified solicitor / DPO before launch.

1. Controller & contact

LynkUps (details at incorporation). Data protection contact:

[email protected]. You may complain to the ICO (ico.org.uk).

2. What we collect

• Account: name/handle, email, date-of-birth verification result (we

store a yes/no "over 18" flag and provider reference — never your ID

documents; verification is performed by a certified provider).

• Profile & activity: interests, events hosted/joined/attended, swipe

history (used only to avoid repeating your deck and to rank it).

• Location: approximate device location while using the app, to show

events near you. Precise venue locations belong to events, not people.

• Content: events you create, group-chat messages, reports you file.
• Technical: device data, logs, telemetry (OpenTelemetry) for security

and reliability.

3. Lawful bases (UK GDPR Art. 6)

• Contract: providing the service (accounts, deck, joining, chat).
• Legitimate interests: safety and moderation (including automated AI review

of events and messages), fraud prevention, service analytics.

• Consent: marketing communications, optional precise-location features.
• Legal obligation: age assurance, responding to lawful requests,

Online Safety Act duties.

4. Automated moderation

Events and messages are screened by automated systems (AI) for safety.

Removal decisions can be appealed to human review — you will not be subject

to solely automated decisions with legal or similarly significant effects

without human review on request (Art. 22).

5. Sharing

Processors under contract only: cloud hosting, identity (Authentik-managed

SSO), age-verification provider, AI moderation processor (Azure/Microsoft),

analytics. We do not sell personal data. Event attendees see your display

name/avatar; hosts see their attendee register.

6. Age verification

We use UK DIATF-certified digital identity services for 18+ checks. The

provider confirms an over-18 result to us; identity documents remain with

the provider under their own policy.

7. International transfers

Data is stored in the UK/EEA. Transfers outside rely on adequacy or SCCs +

the UK Addendum. As we expand to other countries we will localise storage

and policies per jurisdiction (see docs/COMPLIANCE.md).

8. Retention

Account data: life of account + 30 days after deletion. Chat: 12 months

after event end. Reports & moderation records: 24 months (safety/legal).

Telemetry: 90 days. Backups roll off within 35 days.

9. Your rights

Access, rectification, erasure, restriction, portability, objection, and

consent withdrawal — in-app (Profile → Privacy) or [email protected].

Account deletion is available in-app (required by Apple/Google too).

10. Children

LynkUps is 18+. We do not knowingly process children's data; suspected

underage accounts are suspended pending verification.